SY0-701 Question #377: Real Exam Question with Answer & Explanation

Question

An incident analyst finds several image files on a hard disk. The image files may contain geolocation coordinates. Which of the following best describes the type of information the analyst is trying to extract from the image files?

Options

• ALog data
• BMetadata
• CEncrypted data
• DSensitive data

Explanation

Geolocation coordinates embedded within image files are a form of metadata - data that describes other data. Digital images commonly store this in EXIF (Exchangeable Image File Format) fields, which can include GPS coordinates, timestamps, camera model, and other attributes that exist alongside the actual image content.

Why the distractors are wrong:

• A (Log data): Logs are records of system/application events (logins, errors, access attempts) - not embedded file attributes.
• C (Encrypted data): Encrypted data is scrambled and unreadable without a key; EXIF metadata is typically stored in plaintext and readable by standard tools.
• D (Sensitive data): While geolocation can be sensitive, "sensitive data" describes the classification/risk level of information, not the type of data structure being extracted - it's too vague and not technically precise here.

Memory tip: Think "Meta = about." Metadata is data about the file - who took it, when, where, with what device. When a forensics question mentions hidden attributes inside a file (coordinates, timestamps, author info), the answer is almost always metadata.

No community discussion yet for this question.